Sandboxing & Execution Environment

To ensure maximum security and predictability, BlueCurve executes all indexing and job plugins within a hardware-isolated environment powered by Firecracker microVMs.

Firecracker MicroVMs

Unlike traditional containers that share the host OS kernel, Firecracker provides a lightweight virtual machine for each plugin instance. This architecture offers:

• Hardware-Level Isolation: High-security barrier between the plugin code, other tenants, and the host system.
• Predictable Performance: Dedicated resources ensure that your plugin's execution time is consistent and unaffected by other processes.
• Minimal Attack Surface: The microVM environment is stripped of all unnecessary drivers and services, exposing only what is required for plugin execution.

Resource Constraints

Each plugin instance is allocated a fixed set of resources to guarantee performance and prevent "noisy neighbor" issues.

Resource	Default Allocation	Notes
CPU	2 vCPUs	Based on host CPU mapping (with SMT disabled for security).
Memory	512 MiB	Current default. Higher allocations for memory-intensive tasks are planned.
Storage	Volatile	Plugins have access to a temporary scratch space, but it is cleared upon completion.

Execution Lifecycle

1. Deployment: When you deploy a package, it is distributed to the BlueCurve worker nodes.
2. Provisioning: When an indexing or job task is triggered, a fresh microVM is spun up in milliseconds.
3. Execution: Your plugin code starts, performs its work, and emits its output.
4. Teardown: Once the task is complete, the microVM is immediately destroyed, reclaiming all resources.

Double Isolation (WASM)

When using the WASM SDKs, your plugin benefits from Double Isolation:

1. Software Isolation: The WebAssembly runtime restricts the plugin to a managed memory heap.
2. Hardware Isolation: The Firecracker microVM provides a strong virtualization boundary around the entire runtime process.

---

Next: Indexing Plugins